{"id":"CVE-2026-109870","aliases":["EUVD-2026-123157","GHSA-6h65-cg43-m9vg"],"status":"published","title":"User Registration \u0026 Membership 5.2.8 - 5.3.1 - Unauthenticated Privilege Escalation via Coupon-Based Payment Bypass","description":"The User Registration \u0026 Membership  WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-14","score":0.00383,"percentile":0.32946,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-11-11T06:00:05Z","modified":"2026-11-11T12:32:43Z","products":[{"vendor":"unknown","product":"user registration \u0026 membership"}],"references":[{"url":"https://wpscan.com/vulnerability/6cac7dd1-2ae5-4b5b-94c7-a8a4a63ef84b/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109870"},{"url":"https://wpscan.com/vulnerability/6cac7dd1-2ae5-4b5b-94c7-a8a4a63ef84b"},{"url":"https://github.com/advisories/GHSA-6h65-cg43-m9vg"}],"sources":{"cve":[{"id":"CVE-2026-109870","title":"User Registration \u0026 Membership 5.2.8 - 5.3.1 - Unauthenticated Privilege Escalation via Coupon-Based Payment Bypass","description":"The User Registration \u0026 Membership  WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role.","status":"published","published":"2026-11-11T06:00:05.654Z","modified":"2026-11-11T11:45:01.538Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-269"],"updated_at":"2026-11-11T12:57:42.651375Z"}],"euvd":[{"id":"EUVD-2026-123157","description":"The User Registration \u0026 Membership  WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role.","status":"published","published":"2026-11-11T06:00:05Z","modified":"2026-11-11T11:45:01Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T13:28:45.418738Z"}],"ghsa":[{"id":"GHSA-6h65-cg43-m9vg","title":"The User Registration \u0026 Membership  WordPress plugin before 5.3.2 does not verify that a discount...","description":"The User Registration \u0026 Membership  WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role.","status":"published","published":"2026-11-11T06:32:39Z","modified":"2026-11-11T12:32:43Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-11T12:34:06.835386Z"}],"nvd":[{"id":"CVE-2026-109870","description":"The User Registration \u0026 Membership  WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role.","status":"published","published":"2026-11-11T06:17:10.727Z","modified":"2026-11-12T18:49:18.84Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-11T14:25:07.037694Z"}]}}